Tech / IT Support · intermediate

AI-Driven Network Traffic Anomaly Detector

A monitoring tool that ingests live network telemetry and uses an unsupervised ML model to flag anomalous traffic before it escalates into an outage or breach.

Project overview

Tier-2 IT roles increasingly require basic ML literacy to triage network noise. This project shows you can move beyond simple ping-checks to behavior-based monitoring — a critical skill as AI-driven attacks accelerate.

Real-world use case

A small business that wants to detect suspicious traffic spikes (data exfiltration, port scans) without paying for a full SIEM platform.

Tools and technologies

• Python
• Scikit-learn
• MQTT
• Docker
• InfluxDB

Skills you can demonstrate

Anomaly Detection, Network Telemetry, Real-time Inference

Build roadmap

1. Generate or capture sample traffic
   Use scapy to generate normal traffic + a few attack patterns (port scans, beaconing). Or pull a public netflow dataset.
2. Extract behavioral features
   Compute per-host metrics: bytes/sec, unique ports touched, top destinations, protocol mix. Save as a Pandas DataFrame.
3. Train an Isolation Forest
   Fit on the "normal" baseline only. Save the model with joblib so the live service can load it on startup.
4. Build the streaming pipeline
   Containers: traffic capture → MQTT broker → Python consumer that scores each window with the model and writes to InfluxDB.
5. Build the Grafana dashboard
   Live anomaly score, top suspicious hosts, traffic-by-protocol panel. Add alert thresholds.
6. Stress-test and document
   Replay an attack capture (PCAP) and prove the system fires alerts. Capture the demo for your portfolio video.

Ways to extend the project

Add an AI summarizer that turns raw alert logs into a plain-English daily report for non-technical managers.

How to showcase your work

• GitHub: docker-compose stack with sample traffic generators + a labeled anomaly dataset.
• LinkedIn: Screen recording of the dashboard catching a simulated port scan in real time.
• Resume: Focus on "Behavior-based monitoring" and "ML-augmented IT operations".